ClickFix Phishing Campaign Masquerading as a Claude Installe...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.rapid7.com/blog/post/ve-clickfix-phishing-campaign-fake-claude-installer
• Blog Title: ClickFix Phishing Campaign Masquerading as a Claude Installer
• Suggested Section: Windows Hardening -> Antivirus (AV) Bypass (AMSI tampering) and/or Generic Hacking -> LOLBAS/Execution (mshta.exe, HTA) (potential new page: ClickFix/Run-dialog execution + RunMRU artifacts)

🎯 Content Summary

Title: ClickFix Phishing Campaign Masquerading as a Claude Installer (Rapid7, published Apr 16, 2026; activity observed Apr 9, 2026).

High-level
Rapid7 describes a ClickFix-style social engineering chain (no CVE exploitation) where the victim is tricked into executing a command via the Windows Run dialog. The command launches the LOLBin mshta.exe, which fetches a payload disguised as a .msixbundle. That “MSIX” is actually a ZIP containing an embedded HTA with VBScript that deobfuscates strings,...

🔧 Technical Details

ClickFix execution via Windows Run + RunMRU telemetry: Social engineering can coerce a user to paste/run a command through the Windows Run dialog, launching a LOLBin such as mshta.exe to retrieve remote content. Because Run stores the last 26 commands in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU, monitoring RunMRU writes (and the exact command line) is a practical behavioral detection point for ClickFix-style initial execution.

Masquerading a ZIP/HTA as “.msixbundle”: A payload named like an MSIX bundle can actually be a ZIP (PK header) that contains an embedded .hta. When invoked through mshta, the HTA runs VBScript that deobfuscates strings at runtime and spawns the next stage, enabling “installer” lures while delivering script-based malware.

Cmd delayed expansion to hide PowerShell invocation: Use cmd.exe /v:on and variable concatenation (e.g., set x=...

🤖 Agent Actions

I’m mapping the repo first and then I’ll read the most relevant existing pages on mshta, HTA, PowerShell obfuscation, and AMSI tampering before deciding whether anything in the blog is actually new enough to add.
I’ve found three strong candidate areas: an existing ClickFix/clipboard-phishing page, the Windows reverse-shell page with mshta/hta, and the AV bypass page with AMSI internals. Next I’m reading them side by side to see which one can absorb the new tradecraft without duplicating what HackTricks already says.
The existing clipboard-hijacking.md is the best fit. It already covers ClickFix variants, RunMRU hunting, and LOLBin-driven paste flows, so I can add the genuinely new tradecraft from Rapid7 there without splitting the same chain across multiple pages.
I’ve got enough context to edit now. I’m adding a compact subsection to the existing ClickFix page that focuses on the new parts Rapid7 documented: RunMRU telemetry, fake .msixbundle as ZIP+HTA, cmd /v:on PowerShell reconstruction, amsiContext corruption, and the final Native-API shellcode runner.
Updated clipboard-hijacking.md as the single HackTricks target. That page was already the best fit because it centralizes ClickFix, clipboard-to-Run execution, LOLBins, and RunMRU hunting, so splitting this campaign across mshta and AMSI pages would have duplicated the same chain.

The new subsection adds the technical details that were missing from current coverage: fake .msixbundle files that are really ZIPs with embedded HTA/VBScript, cmd.exe /v:on delayed-expansion reconstruction of powershell, per-host MD5-based staging URLs, AmsiUtils.amsiContext corruption via Marshal.WriteInt32, and the final Native-API PowerShell shellcode runner. I also added the Rapid7 blog to the file’s ## References section at the end.

Verification was limited to reviewing the rendered markdown snippet and git diff; I did not run a full docs build.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.rapid7.com/blog/post/ve-clickfix-phishing-campaign-fake-claude-installer

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Antivirus (AV) Bypass (AMSI tampering) and/or Generic Hacking -> LOLBAS/Execution (mshta.exe, HTA) (potential new page: ClickFix/Run-dialog execution + RunMRU artifacts)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0